Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have active directory sign in working on an Ubuntu 12.04 box. When the user signs in, I have a script that runs that needs sudo permission (since it modifies the samba config file). How would I specify this in my sudoers file?

The active directory user is a part of a group called domain users. I see domain users when I issue groups as the active directory user.

I've tried:

%domain+users ALL=NOPASSWD: /etc/userScripts/createSambaShare.php

This still asks me for a password and then tells me that the user is not in the sudoers file.

Is there a log I can check to see what it's doing when it asks the active directory user for their password?

share|improve this question

2 Answers 2

up vote 4 down vote accepted
+50

It looks like you are using a plus sign in lieu of the space in Domain Users. I don't see any reason why that would work.

Instead, escape the space with a backslash:

 %Domain\ Users ALL=NOPASSWD: /etc/userScripts/createSambaShare.php

If that doesn't work, try using an alias:

 User_Alias DomainUsers=%Domain\ Users
 DomainUsers ALL=NOPASSWD: /etc/userScripts/createSambaShare.php

Also, keep in mind that pretty much everything in Linux is case-sensitive, including user and group names. Is the group really showing up as domain users, or is it showing up as Domain Users? It has to match.

share|improve this answer
    
It is listed as domain users and I guess I thought that was the reason for winbind separator = + in my Samba config. Testing now. –  tubaguy50035 Nov 2 '12 at 18:48
1  
backslash does the trick! –  tubaguy50035 Nov 2 '12 at 18:49

Why don't you just set the UNIX group in /etc/sudoers and then make sure everybody is added to that group in AD?

share|improve this answer
    
You mean do something like %Programmers ALL=NOPASSWD: /usr/local/bin/createSambaShare.php ? –  tubaguy50035 Oct 8 '12 at 18:26
    
That seems reasonable enough. –  Michael Hampton Oct 8 '12 at 18:28
    
I did that. My AD user is part of the "Programmers" group in active directory. Looks like my company has it set up so that the AD Domain Services Folder for the group is Domain.com/Staff/Security Groups, does my group in linux then become %DOMAIN.COM/Staff/Security+Groups/Programmers ? –  tubaguy50035 Oct 8 '12 at 19:17
    
You set up the group in UNIX Attributes, right? –  Michael Hampton Oct 8 '12 at 21:51
    
I would assume not. I asked our sys admin about the unix tab for each user and he said he didn't see a unix tab, so I'll refer him to your link on my other question. –  tubaguy50035 Oct 8 '12 at 21:53

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.